Defending against Co-residence Attack in Energy-Efficient Cloud: An Optimization based Real-time Secure VM Allocation Strategy

Diverse studies have been conducted to prevent sensitive information from being transferred through converted channels (i.e. side channels) between co-resident VMs at different levels of cloud infrastructure. First, eliminating side channels from hardware level [52, 25, 30] usually provides more effective defense. However, due to the complex process of introducing new hardware into existing cloud infrastructure, the adoption of such schemes adds extra cost on hardware and administration. Second, extensive researches have been carried out at the hypervisor level. For example, XenPump proposed as a module located in hypervisor [53], monitors the hypercalls used by timing channels and adds latency to potential malicious operations, which increases the error rate in timing channels. In addition, Shacham et al. proposed to make the timer substantially more coarse by removing resolution clocks on Xen-virtualized x86 machines, so that malicious VMs can hardly obtain accurate time measurement [50]. The key drawback of these schemes is that they often require significant modifications on hypervisors. Third, some schemes are proposed at VM OS level [54] or application level [10]. For instance, the authors in [51] proposed to hide real power consumption information from user VMs by deploying a police VM to generate false information. Such schemes do not require substantial changes in the cloud infrastructure and are thus easy to be adopted. Nevertheless, they often suffer from the heavy overhead caused by obfuscating side channel information at the upper level of the cloud infrastructure.

Attackers who aim to launch co-residence attacks against a certain target have to first place their malicious VMs on the same physical host where the target VM locates. Co-residence attacks cannot succeed if this first step fails. Therefore, researches are launched to design security aware VM allocation policies which significantly increase the difficulties for attackers to achieve co-residence.

Many VM allocation policies are studied to assign different positions to VMs. For instance, a randomization way to assign VMs has been proposed [4] to make VMs’ deployment unpredictable to attackers. Han et al. have proposed a co-resident attack resistant VM allocation policy [22], which distributes VMs by optimizing security, workload balance and power consumption needs of cloud servers. Li and Zhang et al. have designed a Vickrey-Clarke-Groves (VCG) mechanism to migrate VMs periodically, so that malicious VMs cannot stay co-located with their target VM for a long time even if they can achieve co-residence [27]. Chhabra et al. proposed an allocation policy to reduces the probability of co-residence by classifying legal VMs and attacker VMs based on historical data, similar approaches often require significant computational analysis and previous knowledge on each incoming request [7], which can be further improved.

Besides security, energy-efficient cloud computing has recently attracted great attention as data centers consume a large amount of electricity and generate giant power bills every year at companies like Google, Facebook, Amazon, etc. Data centers consumed more than 2% of the US total electricity consumption [19]. Different energy-efficient solutions have been applied at ventilation, liquid-cooling systems, and building construction [36]. However, such construction level modification will generate a large amount of cost. Furthermore, cooling systems will also consume a significant amount of electricity. Without conducting hardware level modification, a power-aware VM scheduling algorithm could significantly reduce energy consumption with minimum financial cost and little performance impact. Recent research shows that VM scheduling algorithms have great impact on overall energy consumption of a data center [6]. Therefore, energy-efficiency is used as an important factor for our scheduling algorithm to evaluate the overall performance and efficiency.

The Ant Colony Optimization (ACO) is a meta-heuristic algorithm for finding optimized solutions of computational problems. It is inspired by one behavior of ants, in which they leave pheromone on favorable paths for other members to follow [12]. ACO has been applied to a wide range of optimization problems which are mostly NP-hard. With the initial application to the Traveling Salesman Problem (TSP)[13], ACO has also been applied to solve other problems like sequential order problem (SOP) [18], vehicle routing problem [17, 5], resource constraint project scheduling problem [31].

In cloud computing, ant colony optimization is widely used in task scheduling [37, 38]. Li proposed a Load Balancing Ant Colony Optimization (LBACO) algorithm to achieve task scheduling in dynamic cloud system while in consideration of load balancing at the same time [26]. Feller has applied ACO in workload placement and the results show that this approach provides superior energy efficiency [15]. Similar applications can also be seen in [34] and [32] where ACO has been adopted to address cloud scheduling tasks. However, they do not consider the security aspect.

To the best of our knowledge, this is the first work to apply ACO to address the secure VM allocation issue in cloud. Based on its high efficiency and effectiveness in addressing NP-hard problems, we believe ACO is an appropriate tool to allocate cloud VMs so that the cloud’s overall security, power consumption and workload balance are optimized.

In [28], which is the conference version of the work, we proposed the optimized energy-efficient and security-aware VM allocation strategy against co-residence attack. The preliminary results indicated that the presented research is able to achieve the balance among cloud security, energy-efficiency, and workload balance. The journal version is significantly different from our conference version in the following aspects. First, from the model aspect, rather than assuming all VMs arriving at the same time, this work considers a more realistic real-time scenario as a random number of VMs from different users arriving at the cloud with random timings, which requires the solution to dynamically evolve according to the existing VM allocation status and the incoming new VM requests. Second, from the solution aspect, to balance computational complexity, real time delay and the optimization results, we first introduce time windows to handle VMs in clusters and then apply ACO algorithm for each time window to manage VM allocation. A more in-depth understanding of the ACO algorithm, how and why it is mapped to address the proposed problem have been discussed in a more comprehensive way, which well explained the fundamental working mechanisms of the proposed scheme. Third, as a proof of concept, the conference version only provided basic performance evaluations. More sophisticated experiments and data analysis based on real world cloud workload traces have been conducted in this journal draft. Each of the key parameters of the proposed scheme has been tested and discussed. Additional state-of-the-art comparison scheme has been implemented and compared with the proposed scheme. The results are discussed in details. Last but not least, more comprehensive reviews and analysis of the state-of-the-art literature have been conducted.

As one of the first few works to systematically model the secure and energy-efficient VM allocation problem at IaaS level in cloud, we propose to make the following assumptions to facilitate the establishment of the optimization model later.

First, we assume the cloud receives a random number of VMs from different users at random timings. Periodically, the cloud needs to assign $n_{v}^{t}$ VMs from $n_{u}^{t}$ users arriving in the time duration $t$ to a number of available PMs, so that the VM assignment can minimize security risks, overall power consumption and imbalance of workload among PMs. How frequently the cloud should perform such assignment can be determined to balance time delay, computational complexity and optimal results.

Second, for each time window $t$, the number of PMs involved in the allocation, marked as $n_{s}^{t}$, is not given. As we assume that there are sufficient number of idle PMs to host VMs, $n_{s}^{t}$ should be a value within the range $[n^{t}_{s\_{min}},n^{t}_{s\_{max}}]$. In particular, the minimum number of PMs, $n^{t}_{s\_{min}}$, is achieved when all the VMs are squeezed into the minimal number of PMs to make the utilization as high as possible. On the other hand, the maximum number of PMs, $n^{t}_{s\_{max}}$, is achieved when each VM is assigned to a different PM. In other words, $n^{t}_{s\_{max}}=n^{t}_{v}$. This allocation achieves maximum security since all VMs are isolated on different PMs at the cost of highest power consumption and workload imbalance.

Third, we assume each VM’s workload is dynamically changing during run time based on the real world cloud workload traces. Please note that such changes will lead to fluctuations of the power consumption and workload balance, and may occasionally cause overload of PMs which triggers dynamic VM migrations among PMs in cloud. These above assumptions make our model more realistic but also more challenging to address.

Fourth, regarding the security aspect, we assume that all VMs from a malicious user are malicious. The attack goal is to have the malicious VMs achieve co-residence with VMs from as many normal users as possible to facilitate later attacks. In addition, from the defender side, we also assume that according to historical data, the cloud is able to estimate the percentage of malicious users, but does not know which specific users are malicious. This assumption requires that the proposed scheme can develop the best allocation strategy based on different security context. In the case where the cloud does not have a good estimation of the malicious user percentage, this value can always be set as 100% to treat security in the most conservative way, which will result in an allocation solution that minimizes the co-locations of VMs from different users.

With the above assumptions, we model the overall VM allocation problem as an optimization problem, of which the optimization goal is to minimize (1) the security risks, which is modeled as the probability of malicious VMs co-locating with the VMs from normal users (i.e. $R_{sec}$), (2) the overall power consumption of used PMs to run these VMs (i.e. $f_{Power}(u)$), and (3) the workload inequality among different PMs (i.e. $B_{w}$). Therefore, we design the objective function of this optimization problem as follows.

where $c$ represents the objective function value or cost value, $w_{1},w_{2},$ and $w_{3}$ represent weights for the three factors respectively.

Then the next question is how to quantify these three factors in a reasonable way. In this work, we propose the quantification of these factors as follows.

As proved in other existing studies [21, 22], we recognize the optimization issue modeled in the above section as an NP-complete problem. However, the problem is even more complex as in reality, cloud servers continuously receive dynamic VM requests and the workload of existing VMs is also dynamically changing.

To make the model more realistic, we assume that users’ requests arrive at the cloud end with random timings. Furthermore, the request from each user may be realized through a random number of VMs. In particular, we 1) adopt Poisson distribution to simulate the incoming VMs’ arrival rate; 2) introduce time window concept to group incoming requests to balance optimal assignment solution, computational complexity and allocation delay; 3) use real world cloud traces for VM workload simulations.

Next, we propose to adopt Ant Colony Optimization (ACO) as a solution to the proposed optimization model. Inspired by natural ant activities, ACO is an algorithm integrating both heuristic information and randomness to find the optimized solution to a problem [12]. The basic idea is that ants carry back their food to colony through different random trails initially, and meanwhile release pheromone on their trails. After a while, trails that take ants less time to travel are piled up with pheromone and become more attractive to ants traveling later. In this way, the shorter trails are reinforced again and again, so that eventually the shortest one will stand out.

A typical application of the ACO algorithm is traveling salesman problem (TSP), an NP-hard problem, of which the optimization goal is to find the shortest path to traverse all cities in a given map. In particular, given an ant $k$ at a city $i$, the probability for this ant to choose the next city as $j$ is calculated as follows.

where ${\bf N}$ is the set containing all the cities that are not visited by ant $k$ yet; $\tau_{ij}$ and $\eta_{ij}$ represent the pheromone and heuristic value of selecting city $j$ to visit next after city $i$. The heuristic value $\eta_{ij}$ can be calculated based on the direct distance between cities $i$ and $j$ (i.e. $d_{ij}$) as follows.

From the above discussion, we can see that the heuristic value $\eta_{ij}$ is determined by the direct distance between cities $i$ and $j$, which is consistent with the intuitive way of determining the shortest path. In addition, the pheromone value $\tau_{ij}$ may initially represent randomness, as ants may take random trails and lay pheromone, and is gradually reinforced by later ants’ choices/experiences (i.e. if the path from city $i$ to city $j$ is frequently selected as part of the best path). By adjusting the two parameters $\alpha$ and $\beta$, which range from 0 to 1, ACO can dynamically adjust how important the pheromone and heuristic values are considered, respectively. For example, when $\alpha=0$, the pheromone information is completely ignored; and the ACO algorithm becomes a pure greedy algorithm. On the other hand, when $\beta=0$, the heuristic information is completely ignored; and the ACO algorithm becomes a pure random searching algorithm.

By taking both information into account, the ACO algorithm aims to identify the optimal trail by integrating “exploitation” (selecting “optimal” action based on heuristic information that is already known) and “exploration” (attempting to discover new possibilities by selecting a sub-optimal action with certain randomness). In addition, as different ants are independent from one another, the ACO algorithm can be naturally implemented in a distributed way to improve efficiency. Therefore, the ACO algorithm is often applied on NP-hard problems to efficiently find high quality solutions.

The advantages of ACO make it a promising approach to address the secure VM allocation issue in cloud. Therefore, we would like to adopt ACO in the proposed scheme to address the optimization problem discussed in Section 3.2. However, such adoption is not trivial due to several challenges. First, how to map the VM assignment issue, which involves two parties as the VM and the PM, to a city visit problem that only considers one party (i.e. cities)? Second, different from TSP where the number of cities to visit is fixed, the secure VM allocation problem only specifies the number of VMs to assign, while leaving the number of physical servers open. How to determine the optimal number of PMs involved? Third, how to model the heuristic and pheromone values in the VM assignment scenario?

We aim to address these challenges in the following two sections. In particular, we need to handle two major steps as: (1) mapping VM allocation as a shortest path problem, and (2) designing heuristic and pheromone values in VM allocation.

In this section, we compare the proposed scheme with two other existing allocation strategies. The first one is Round-Robin, a classic algorithm that allocates resources, e.g. physical machine (PM), in equal portions and in circular order, handling all VMs without priority. In particular, as the original Round-Robin algorithm cannot specify the number of physical PMs to be involved for allocation, we implement the algorithm in a way that the algorithm spawns a group of PMs each time. We set the number of PMs in a group as 2, 4, 6 and 8 each time a new spawning process is needed. The modified Round-Robin algorithms are named RR2, RR4, RR6, RR8 respectively and we examine their performances at different choices of the number of spawning PMs.

The second one is the Previously-Selected-Servers-First (PSSF) scheme proposed in [22], a representative study of the state-of-the-art VM allocation schemes that optimizes security, workload balance and power consumption through a heuristic strategy. In particular, PSSF tends to select from two strategies: stacking or spreading. Each new VM will be first stacked to the same PM to which other VMs from the same user has been allocated. If the PM has reached its capacity, the new VM will be spread to a new PM. Similar to Round-Robin, PSSF cannot explicitly determine the number of physical PMs to involve. Instead, it involves a group of physical PMs each time, and the new group of PMs will not be involved until the existing PMs reach their capacity. Therefore, a key parameter for PSSF is the number of PMs in each group. In our experiments, we set the number as 2, 4, 6 and 8, respectively to examine its performance and name the algorithms as PSSF2, PSSF4, PSSF6, and PSSF8, respectively.

As discussed in Section 3.3.1, we use Poisson distribution to simulate different scenarios where the number of users and VMs increases as the parameter $\lambda$ increases in a given amount of time. In particular, $\lambda$ varies from 0.001 to 0.01, which indicates the number of incoming VMs ranging from 10 to 100 during the total experiment duration. We generate 100 sets of data from Poisson distribution at each $\lambda$ values and take the average performance to make a fair comparison. The representative results are presented in Fig. 7.

Fig. 7 contains 4 subplots with $\lambda$ set to 0.001, 0.004, 0.007 and 0.01, representing the scenarios with the VM numbers as 10, 40, 70 and 100 respectively to demonstrate the performances of the proposed scheme, Round-Robin and PSSF. In addition, the malicious user percentage is set as 20%, a reasonable estimation on the malicious context, and the weights for security, power, and workload inequality are all set as 1/3. The bars from left to right represent the proposed scheme with its key parameter (i.e. time window length) equals 500, 1000, 2000 and 5000; Round-Robin with span set to 2, 4, 6, and 8; and lastly PSSF with span set to 2, 4, 6, and 8.

As shown in Fig. 7, the total cost of the proposed scheme on the top right subplot, where $\lambda$ equals 0.004, drops at time window length 200 and then increases along with the increase of time window length. This is because when the incoming number of VMs are relatively small, the number of VMs falling in one time window may vary, leading to some inconsistencies in the performance. As the number of VMs increases where $\lambda$ equals 0.007 and 0.01 on the bottom two subplots, the proposed schemes tends to be more stable with a downward slope as time window length increases. This is because when time window length increases, a larger portion of incoming VMs are considered by the algorithm at each calculation, thus results in a lower overall cost. On the other hand, larger time window length means longer average wait time for each incoming VM before assigning to a actual PM. The trade off here has to be considered in a real world scenario to accomplish an optimized configuration.

Among these algorithms, the proposed scheme always achieves the best performance in terms of the optimal total costs, which validates its effectiveness. Moreover, the detailed subcosts for security, power, and workload balance are also shown for each allocation scheme. There are several observations. First, at $\lambda$=0.001, the proposed scheme with time window length set to 100 achieves the best overall score. PSSF4, PSSF6 and PSSF8 achieves the exact same score with zero cost on security. This is because when the number of incoming VMs is relatively small (10 VMs in this case), according to the behaviour of PSSF, VMs will simply span to a new server when there are enough PMs allocated. This results in zero security cost. However, because of the usage of new PMs, the power costs will significantly increase, leading to much higher overall costs. Secondly, when $\lambda$=0.004, the proposed scheme with time window length 2000 achieves the minimum overall costs. Even though PSSF6 has the lowest security cost, the proposed scheme has far less power cost compared to PSSF6, which results in an overall lowest cost. RR2, RR4, RR6 and RR8 behave similarly to PSSF, but with higher security cost since they tend to stack VMs from different users into the same PM. When $\lambda$=0.007, there are total 70 incoming VMs, which makes it a more realistic scenario. The proposed scheme outperforms both RR and PSSF, and the worst score of the proposed scheme is nearly the same as the best score of both RR and PSSF. Both RR and PSSF have significantly larger power cost and workload balance cost than the proposed scheme because the way the stack up VMs and spawning PMs, and the choices of span 2, 4, 6, 8 of the two schemes among different $\lambda$ does not always generate the same results, which make it hard to detect the optimized choice of span in a complex, realistic scenario. Similar observation can be concluded on the last subplot when $\lambda$ is set to 0.01 with a total of 100 incoming VMs, this confirms that the proposed scheme is robust and scalable with better performance among all there schemes.